Hi-Tech

Kaspersky warns of malware targeting African organisations

March 13, 2018 01:33·
Sophisticated malware attacks through routersMore

Sophisticated malware attacks through routersMore

The malware, which researchers called "Slingshot", attacked and infected victims through compromised routers and could run in kernel mode, giving it complete control over victim devices.

Kaspersky says in a press release that Slingshot's sophistication suggests that the attackers behind it are "professional and probably state-sponsored". Since this library is loaded by "services.exe", a process that has system privileges, the poisoned library gained the same rights.

Two areas which Kaspersky believes to be particularly advanced are a kernel mode module called Cahnadr and GollumApp, a user mode module. The driver is used to provide persistence for GollumApp and to thwart debugging and anti-rootkit procedures.

According to Kaspersky, Slingshot primarily focuses on spying activities, such as collecting screenshots, keyboard data, network data, passwords, USB connections, other desktop activity, clipboard contents, and more.

Once it infects a router, Slingshot is able to deploy "huge and powerful" modules on a target computer.

Slingshot appears to have been active as far back as 2012 thanks to its suite of encryption and security-bypassing techniques.

So far, researchers have seen around 100 victims of Slingshot and its related modules, located in Kenya, Yemen, Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania.

A report from Moscow-based Kaspersky Lab details how a threat it's calling "Slingshot" has been infecting victims, collecting a wide variety of data and exfiltrating it in a covert fashion. If you're running a Mikrotik router and haven't updated the firmware in the last, well, six years, you should download the appropriate package from its website. This triggered a detection that turned out to be an infected computer with a suspicious file inside the system folder named scesrv.dll. According to MikroTik's support forums, that exploit only works on RouterOS version 6.38.4, but one of the compromised routers found delivering Slingshot was running version 6.38.5, so it's possible a different exploit was used.

Brown tells Trump California is focused 'on bridges, not walls'
California has otherwise clashed viciously with the federal government , particularly on immigration issues. We invite you to come aboard and truly "Make America Great Again".

Days at Barca 'a kind of hell' - Andre Gomes
The treatment he's received when he has been on the pitch has often left him not wanting to venture out for days after a match. Things changed after my first six months and there was more pressure, which is fine but I'm too self-critical of myself.

Brabham Names New Car BT62, Engine Sound Revealed
Although not at all revealing, it does have a scent of a naturally aspirated V8. Perhaps more exciting than the name is the way the auto sounds.

The researchers note that owners of a MikroTik router and WinBox managing software should download the latest version of the program alongside updating the router itself to the latest version on its operating system. When forensic tools are active, for example, Slingshot is intelligent enough to shut down certain components.

Slingshot, discovered by Kaspersky Lab, is one of the more interesting pieces of recently discovered malware.

The company's global DDoSmon service observed 50 Memcached amplification attacks per day on average before February 24, but their frequency quickly rose to 372 per day by the end of last month and 1,938 per day this month.

Use a proven corporate grade security solution in combination with anti-targeted attack technologies and threat intelligence, like Kaspersky Threat Management and Defense solution (https://goo.gl/ea1ZqV).

The good news is that researchers from DDoS mitigation provider Corero Networks have discovered a "kill switch" that can be used to stop Memcached servers from sending malicious traffic.

The number of publicly exposed Memcached servers abused for DDoS reflection and amplification every day varied between under 10,000 and 20,000.

The countermeasure relies on the "flush_all" command that will instruct an abused server to invalidate its cache, including the large payloads put there by attackers.

Recommended News

Join The Conversation

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.